Lee Sharp ha scritto:
> Tonix (Antonio Nati) wrote:
>> If monowall people is so closely bind to the WAN, LAN, OPT1 model,
>> there is very few to discuss. Then it's time to start a m1n1 project,
>> with wider views.
>
> I am not sure where you got this, but it ain't from us. Many of the
> core people on this list have at least one (or many more) firewall
> with 10+ interfaces on it. However we often support people that have
> multiple interfaces for absolutely no reason. One guy wanted to
> bridge 5 interfaces because he could not afford a switch! So we teach
> the LAN WAN Opt1 model to beginners because they are beginners. We
> also use the inbound model because it is simple to understand.
> Complexity breads mistakes which lead to insecurity. The Pix is a
> very secure firewall, but is often deployed insecurely by people who
> do not understand it. Not a surprise as the Pix is a lesson in user
> unfriendliness...
So, you think helping people giving less choises.
Add a system flag about which kind of rules can be enabled: inbound,
outbound, mixed.
Give the opportunity to make more, and each one can chose his own model
(based on his own experience).
>
>> But if you consider that this firewall is very used because of the
>> speed, and because of the speed is used in a lot of big
>> configurations, where people has:
>
> [snip vlan party]
>
>> than you may see that
>>
>> * ONE outbound rule written in the server VLAN eliminates the need
>> for other 11 rules which should be written in each of the other
>> interfaces.
>
> Only if all other interfaces are wide open inbound. This is not what
> I do on any system I manage.
Why??? You don't need to open inbound on other interfaces for allowing
outbound. It depends on the position of the rule.
> [ snip ]
>> I hope monowall is ready to make the step to be a more complete
>> firewall.
>
> We have made a conscious decision to not make m0n0wall the HP
> All-In-One-Printer of firewalls. m0n0wall is meant to be lean, mean,
> and above all secure. So far what you have proposed gives some small
> convenience at a substantial cost in complexity and security.
>
> However, the biggest problem is that you seem to not want to consider
> that there are other ways of doing this. It would be easy to add a
> script on each interface page, "Create reciprocal inbound rules."
> When you click that it gives all the usual fields but the interface
> field would allow you to ctl-click all or some of the interfaces.
In which position in the other interfaces lists? Before all? After all?
> As to management, I agree that a page that would allow you to view all
> interfaces filtered by a given parameter would be nice. This only
> requires some php programming, and NO CHANGES TO THE CORE OF M0N0WALL.
Also what I ask requires only PHP programming. No change to the core,
just a different way of writing rules.
> Also there is a m0n0wall management project that could allow you to
> write a firewall client to make rules however you want them. However,
> if you are dead set on core changes, then by all means fork it. There
> are several forks of m0n0wall, and all have made a positive
> contribution. (FreeNAS, pfSense, AskoziaPBX) You can even find the
> devs of those projects all over the m0n0wall lists. You may have
> something a lot of other people want. I, however, am not one of
> them. And judging by the lack response here, neither are a lot of
> other developers. However, (I seem to be using that word a lot) if
> you do fork the project, I would give you any information and help
> that I could. I am sure that most of the other people here would as
> well, if you keep us on good terms.
I appreciate your help, but I'm not willing to fork, unless I have no
choice (just because I have too much work.to do on other products).
Before forking I will consider also other open source firewalls, as well
as funding m0n0 (or pfsense) for making what I ask.
Thanks,
Tonino
> Lee
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: m0n0wall dash dev dash unsubscribe at lists dot m0n0 dot ch
> For additional commands, e-mail: m0n0wall dash dev dash help at lists dot m0n0 dot ch
>
>
--
------------------------------------------------------------
Inter@zioni Interazioni di Antonio Nati
http://www.interazioni.it tonix at interazioni dot it
------------------------------------------------------------